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There  is  a tendency  in  presentations  of  structured  programming  to  avoid  the  use  of 
recursion  as  a repetitive  construct,  and  to  favor  Instead  the  while  statement,  the 
guarded  command,  or  other  iterative  loop  constructs.  For  instance,  In  his  recent  book,  "A 
Discipline  of  Programming"  [2],  Dijkstra  bars  recursion  from  his  exemplary  programming 
language;  although  he  does  not  absolutely  forbid  recursion  to  the  qualified  practitioner, 
he  warns  that  "I  regard  general  recursion  as  an  order  of  magnitude  more  complicated 
than  just  repetition,"  and  declares  that  "I  don't  like  to  crack  an  egg  with  a 
sledgehammer,  no  matter  how  effective  the  sledgehammer  is  for  doing  so." 

The  method  by  which  an  iterative  loop  is  to  be  constructed  is  clearly  dictated:  We 
are  first  to  find  an  Invariant  assertion,  a relation  between  the  variables  of  the  program, 
and  a termination  function,  an  expression  Involving  the  program's  variables  whose  value  Is 
a nonnegative  Integer.  The  loop  body  Is  then  constructed  so  as  to  reduce  the  value  of 
the  termination  function  while  maintaining  the  truth  of  the  Invariant  assertion  upon  each 
execution  of  the  loop  body.  In  this  way,  the  correctness  and  termination  of  the  resulting 
program  are  guaranteed  by  the  nature  of  the  construction  process.  The  decision  when 
to  introduce  a loop,  and  the  choice  of  an  appropriate  invariant  assertion  and  termination 
function,  are  not  determined  by  the  method;  generally  they  are  left  to  the  Intuition  of  the 
programmer. 

For  example,  In  constructing  a program  to  compute  the  exponential  function  z - x3>  of 
two  integers  x and  y (where  x Is  positive  and  y is  nonnegative),  Dijkstra  recommends 
that  we  introduce  new  variables  xx  and  yy,  and  take  the  Invariant  assertion  to  be 

z-xxyy-xJ 

and  the  termination  function  to  be  yy  Itself.  The  Invariant  assertion  Is  established 
initially  by  taking  xx,  yy,  and  z to  be  x,  y,  and  1,  respectively;  the  task  of  the  loop  body 
is  to  maintain  this  invariant  assertion  while  reducing  the  termination  function  yy  to  0. 
Employing  familiar  properties  of  the  exponential  function,  he  derives  the  program  * 

(xx  yy  z)  ♦-  (x  y 1) 

while  yy  n 0 

do  (yy  z)  *- (yy- 1 z*xx) . 

This  program  is  transformed  subsequently  to  a more  efficient  version. 


"Actually,  Dijkstra  obtains  the  invariant  in  two  stages:  he  first  introduces  a new  variable  k and 

attempta  to  maintain  the  invariant  k-z  ■ xf  ; he  then  replaces  h by  the  term  xxfl.  His  final 
program  is  expressed  in  terms  of  the  guarded  command  construct. 
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In  discussing  how  such  invariant  assertions  and  termination  functions  are  to  be 
discovered,  Dijkstra  appeals  to  his  "inventive  powers"  and  uses  phrases  such  as  "my 
experience  suggests  ..."  and  "the  trick  is  that  ...  ."  Of  course,  the  exponential  is  a 
familiar  program,  and  these  choices  may  appear  natural  or  even  Inevitable.  But  if  we  had 

never  seen  the  program  before,  how  would  we  know  to  select  - xf  as  the 

invariant  assertion  while  reducing  the  termination  function  yy  to  0?  Why  not  maintain 

z+xxW  - xf  while  reducing  xx  to  0,  or  maintain  zff  ■ xf  while  reducing  yy  to  I , or  even 
maintain  while  reduolng  xx  to  1 or  yy  to  0? 


In  general,  at  each  stage  in  the  derivation  there  are  Innumerable  conditions  and 
functions  that  could  be  adopted  as  the  Invariant  assertion  and  termination  function  of  a 
loop;  only  a few  of  these  choices  lead  to  the  successful  completion  of  a derivation. 
With  so  many  plausible  candidates  to  choose  from,  a correct  selection  requires  an  act  of 
precognitlve  insight. 


The  answer,  of  course,  Is  that  we  must  defer  the  Introduction  of  a loop  until  It  Is 
forced  upon  us  by  the  structure  of  the  program's  derivation.  For  this  purpose,  we  have 
found  recursion  to  be  far  more  useful  than  any  of  the  Iterative  constructs;  a recursive 
call  can  be  introduced  when  a recurrence  is  observed  in  the  derivation.  Applying  this 
approach,  we  avoid  the  premature  selection  of  an  Invariant  assertion  and  termination 
function. 

For  example,  let  us  again  consider  the  construction  of  an  exponential  program 


exp{x  y),  intended  to  achieve  the  goal  of  computing  the  expression  xf.  Employing  the 
same  properties  of  the  exponential  function  that  Dijkstra  applied  in  his  derivation,  we 
reduce  our  goal  to  the  subgoal  of  computing  the  constant  1 In  the  case  that  y Is  0,  and 


to  the  subgoal  of  computing  the  expression  x-xf~^  in  the  case  that  y Is  positive.  We 

observe  that  the  subexpression  x?-1  is  an  instance  of  the  top-level  goal  expression  x?; 
at  this  point,  we  decide  to  Introduce  a recursive  call  exp{x  y-1)  to  compute  this 
subexpression.  This  call  cannot  lead  to  a nonterminating  computation,  because  the 
second  argument  y- 1 of  the  recursive  call  Is  a nonnegative  integer  less  than  the  second 
input  y.  The  final  program  obtained  Is  thus 

ex p(x  y)  <-  if  y - 0 

then  I 

else  x>exp(x  y-\)  . 


This  program,  like  Its  iterative  counterpart,  is  guaranteed  to  be  correct  by  virtue  of  the 
way  it  was  constructed,  and  can  be  transformed  Into  c more  efficient  version  in  a 
subsequent  optimization  phase.  This  optimized  version  can  be  recurve  or  iterative. 


In  general,  a recursive  call  is  formed  when  a subgoal  in  the  program's  derivation  is 
found  to  be  an  instance  of  a higher-level  goal;  the  decision  to  introduce  the  recursive 
call,  its  form,  and  the  choice  of  the  termination  function  are  all  dictated  by  the  structure 
of  the  derivation;  the  choice  of  the  invariant  assertion  is  avoided  altogether. 

Another  example:  In  constructing  a program  to  find  the  Index  of  the  maximum  element 
of  an  array,  we  want  to  assign  a value  to  a global  variable  l such  that 

a[i]  2 alt(a[0  : n])  and 
0 i » i n , 

where  n Is  a nonnegatfve  integer  and  a[0  : n]  Is  an  array  segment  of  n+ 1 numbers  a[0], 
a[l],  . . . , a[n].  In  other  words,  we  need  to  achieve  that  a[i]  Is  greater  than  or  equal  to 
every  element  In  the  array  segment  and  that  l Is  between  0 and  n. 

In  approaching  this  problem,  Dljkstra  [2]  produces  the  invariant  assertion"* 

a[i)  i all(a[0  : j])  and 
0 i i i J and 
jin, 

explaining:  "A  standard  way  of  generalizing  a relation  is  the  replacement  of  a constant 
by  a variable  — possibly  with  a restricted  range,"  and  adding  that  "the  condition  Jin 
has  been  added  In  order  to  do  justice  to  the  finite  domain"  of  the  array  segment  a[0  : n]. 
As  to  the  termination  function,  he  continues:  "Again,  my  experience  suggests  to  choose 
a monotonlcally  decreasing  function  ...  n-J  ....  In  order  to  ensure  this  monotonic 
decrease  . . .,  I propose  to  subject  j to  an  increase  by  1 ...  ."  By  application  of  the 
properties  of  the  natural  numbers  and  the  concept  of  the  "weakest  precondition," 
Dljkstra  develops  the  program 

(*/>«-(  0 0) 
while  j * n 
do  If  a[t]  2 a[j] 
then  j «- 1 
else  (ij)  *-  (J  j+l)  . 

In  our  approach,  we  want  to  construct  a program  maxl(a  n),  whose  goal  is  again  to 
assign  a value  to  i such  that 


Again  we  take  certain  liberties  with  Dijkstra’s  notation. 


A 
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a[i]  2 all(a[ 0 : n])  and 
0 s i s n . 

In  the  case  that  n is  0,  this  condition  Is  satisfied  by  taking  l to  be  0;  in  the  other  case, 
the  condition  a[i]  2 all(a[0  : n])  decomposes  into  the  conjunction  of  two  subgoal 
conditions, 

a[i]  2 a//(a[0  : n—  1 ])  and  a[t]  2 a[n]  . 

(Other  decompositions  are  possible;  the  final  program  derived  depends  on  which 
decomposition  is  chosen).  The  .first  of  these  subgoals  Is  an  Instanoe  of  the  oondltlon  a[<] 
2 all(a[0  : n]),  which  Is  part  of  the  top-level  goal;  we  therefore  attempt  to  aohleve  It  with 
a recursive  call  maxi(a  n- 1).  Termination  Is  ensured  because  the  second  argument  n-1 
of  the  recursive  call  Is  less  than  the  second  input  n.  The  second  subgoal  a[i]  2 a[n]  is 
achieved  without  introducing  any  recursive  calls.  The  final  program  obtained  is 

maxi(a  n)  <■  if  n - 0 

then  i «-  0 
else  maxi(an-l) 

If  a[t]  < a[n]  then  i «-  n . 

Note  that  our  use  of  recursion  as  a repetitive  construct  In  this  program  has  not 
precluded  the  use  of  assignment  statements  or  even  global  variables. 

Tne  recur sion- formation  technique  illustrated  by  these  simple  examples  is  a basic 
principle  of  our  approach  to  systematic  program  derivation.  This  approach,  presented  in 
detail  In  [6],  was  designed  for  automatic  program-construction  systems;  therefore,  even 
when  applied  by  the  human  programmer,  It  cannot  rely  on  any  leaps  of  intuition.  The 
recursion-formation  approach  does  not  always  make  the  act  of  programming  easy,  but  it 
does  avoid  the  extraordinary  feats  of  Ingenuity  characteristic  of  the  Invariant-assertion 
approach. 

Not  everyone  concerned  with  programming  methodology  has  been  completely 
enamored  of  the  invariant  assertion  as  a means  for  program  construction.  For  example, 
in  [6],  Knuth  compares  two  iterative  programs  for  a moderately  complex  task;  one  was 
developed  by  Inventing  an  Invariant  assertion  while  the  sec  >nd  was  derived  by  first 
constructing  a simple  recursive  program  for  the  same  task,  and  then  transforming  It.  He 
observes  that  "the  recursive  program  Is  trivially  correct,  and  the  transformations  require 
only  routine  verification;  by  contrast,  a mental  leap  is  needed  to  invent  [the  invariant 
assertion]." 


Some  of  the  proponents  of  the  "Structured  Progra;.  ning  School"  admit  the  use  of 
recursion  when  it  is  especially  called  for;  e.g.,  Wirth  [7]  advises  that  recursion  Is 
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"primarily  appropriate  when  the  problem  to  be  solved,  or  the  function  to  be  computed,  or 
the  data  structure  to  be  processed,  sre  already  defined  in  recursive  terms."  Some 
researchers,  such  as  Gries  [3]  and  Hehner  [4],  have  praised  the  simplicity  and  clarity  of 
recursive  programs,  while  others,  such  as  Burstall  and  Darlington  [1],  have  found 
recursive  programs  to  be  easier  to  transform  and  manipulate. 

Our  point  here  Is  different:  recursive  programs  are  not  only  simpler  to  understand  and 
manipulate,  but  also  are  easier  to  construct,  in  that  their  formation  does  not  require  the 
premature  invention  of  an  invariant  assertion.  For  all  these  reasons,  recursion  seems  to 
be  an  ideal  vehicle  for  systematic  program  construction.  It  Is  surprising  that  some  of  the 
advocates  of  structured  programming  have  not  adopted  it  with  more  enthusiasm:  in  their 
fidelity  to  iteration,  they  have  been  driven  to  resort  to  more  dubious  means. 
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